Repository navigation
fix: defer Codex ticket gate to authoritative scheduler account - #188
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production request
5d66478e-14ec-4335-894c-000e893ef31cfailed selection withpool=4, runtime_blocked=4even though accounts 16376, 16378, and 16379 had valid 292 tickets. The load-aware and advanced scheduler candidate loops evaluated the credential-bound Codex ticket gate against the partial scheduler snapshot. That projection intentionally dropscodex_turn_ticket:*and the OAuth identity credentials (chatgpt_account_id,chatgpt_user_id,organization_id,email), sofail_closed=truetreated valid tickets as missing and excluded every ticket-capable account before the authoritative account was hydrated.Split the runtime-block check into an authoritative gate and a projection-safe candidate gate. The candidate gate keeps persisted cooldowns, model limits, runtime breaker, Cindy state, and every other projection-safe veto, but defers Codex ticket validation to the existing
resolveFreshSchedulableOpenAIAccount/recheckSelectedOpenAIAccountFromDBpath. Both the legacy load-aware and advanced scheduler candidate loops use the candidate gate; every final selection still rechecks the full account with the authoritative gate, preserving exact-292 validation, owner binding, andfail_closed.Startup ticket seeding now refreshes the authoritative scheduler snapshot for every still-valid stored ticket, so a restart cannot leave a durable ticket invisible to the full-account cache. Scheduler metadata still does not receive ticket material; no API, DTO, database migration, frontend, proxy, or production setting changes are included.
Validation: new unit tests cover candidate-versus-authoritative behavior for missing, expired, wrong-principal, and wrong-length tickets, plus successful selection through both legacy load-aware and advanced scheduler paths while fail-closed remains effective for ticketless accounts. The repository integration test verifies startup seeding refreshes the full scheduler snapshot.
TestOpenAI*unit tests,go vet, and integration-test compilation pass locally; the normal Linux PR checks will execute the PostgreSQL integration suite.